EU leaders are weighing how to respond to suspected hybrid and cyberattacks at this week’s summit in Brussels. Discussions include what to do if a major attack kills dozens of civilians, the Swedish news agency TT reported.

An unnamed senior EU official told TT that more countries were becoming targets and Russia was expanding its attacks. Whether the reported incidents are connected remains unclear, and Russia has denied involvement in incidents it is accused of causing.

Sweden backs responses that are not publicly disclosed

Swedish Foreign Minister Maria Malmer Stenergard said Russia was taking greater risks and acting more carelessly. She said its aim was to frighten European countries into ending support for Ukraine. EU leaders have publicly said the incidents instead strengthen that support.

Malmer Stenergard backed discussing alternative responses, including measures whose details would not be disclosed. She said Russia should not know exactly how European countries respond, but should know they are united.

Advertisement

Most EU countries also belong to NATO, whose Article 5 provides for collective assistance in an attack. Uncertainty over who carried out a hybrid attack makes deciding on a response more difficult.

Teija Tiilikainen, of the European Centre of Excellence for Countering Hybrid Threats in Helsinki, warned of possible deaths. Speaking to Politico Europe, she said Russia was using increasingly deadly tools to test preparedness and willingness to respond.

European governments point to suspected sabotage

Germany has accused Russia of being behind explosive-laden drones found near Ukrainian military aircraft in Leipzig in August. An August arson attack on a defence-materials manufacturer in Tallinn, Estonia’s capital, has also been described as Russian sabotage, TT reported.

Several merchant ships were attacked earlier in October in Bulgaria’s economic zone in the Black Sea. Bulgaria summoned the Russian ambassador in response.

In France, hackers disabled hundreds of supermarket refrigeration and freezer units early this week. No one has been formally identified as responsible for that attack.

Cyberattacks disrupt food supplies and tunnel work

A Swedish website reported that the French attack affected Intermarché, Carrefour and Coopérative U. Some freezers were switched to defrost mode at temperatures reaching 50°C. Many stores used outdated control systems connected directly to the internet.

The same report described a weekend network intrusion affecting Dutch supermarket chain Albert Heijn and its parent, Ahold Delhaize. IT experts and internal reports indicated that ransomware was probably involved. A precautionary shutdown on Sunday disrupted distribution centres, leaving fresh-produce shelves empty in cities including Amsterdam and Utrecht.

A cyberattack also disrupted FLC, the consortium building the Fehmarn Belt tunnel between Denmark and Germany. Media reports cited failures in access-card systems and specialised equipment, with work partly or fully halted.

Henning Mortensen, chair of the Danish Council for Digital Security, said a hybrid-warfare connection could not be ruled out. The Swedish report said Denmark’s security service had recently raised its cyberattack threat level to high after warnings of increased Russian activity targeting critical European infrastructure.